[merge-train skip]

[ci skip]

[ci skip]

Alexis Kalderimis authored 3 years ago and Mayra Cabrera committed 3 years ago

Quarantine failing group board spec

See merge request gitlab-org/gitlab!64809

Disable filesystem and network premailer strategies

See merge request gitlab-org/security/gitlab!1545

Changelog: security

[merge-train skip]

[ci skip]

[ci skip]

Geo - Fix state value in the lfs_object_registry table

See merge request gitlab-org/gitlab!65466

Prepare 13.12.7-ee release

See merge request gitlab-org/gitlab!65366

Backport !64632 to 13.12.7 [RUN ALL RSPEC] [RUN AS-IF-FOSS]

See merge request gitlab-org/gitlab!65430

The migration is performant, and moving it to
pre-deployment migration makes the update instructions
simpler.

Changelog: changed
EE: true

The new state column in the `lfs_objects_registry`
table is set to 0 by default which means pending
that causes Geo to redownload each LFS file.

Changelog: fixed
EE: true

Jan Provaznik authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/64697

Changelog: fixed

[merge-train skip]

[ci skip]

[ci skip]

Prevent GraphQL API access by deactivated users

See merge request gitlab-org/security/gitlab!1526

Forbid GET requests with mutations

See merge request gitlab-org/security/gitlab!1529

Bump rails gem version to 6.0.3.7

See merge request gitlab-org/security/gitlab!1515

Copy feature visibility settings to a fork

See merge request gitlab-org/security/gitlab!1523

Update rdoc to 6.3.1

See merge request gitlab-org/security/gitlab!1534

Add new username validation

See merge request gitlab-org/security/gitlab!1495

Avoid disclosing project in web IDE

See merge request gitlab-org/security/gitlab!1512

Clipboard DOM-based XSS in Markdown [RUN AS-IF-FOSS]

See merge request gitlab-org/security/gitlab!1453

Add sanitizing for name field

See merge request gitlab-org/security/gitlab!1490

Fix XSS in release Edits

See merge request gitlab-org/security/gitlab!1486

Fix XSS on audit log for feature flag actions

See merge request gitlab-org/security/gitlab!1474

Update Nokogiri to 1.11.4

See merge request gitlab-org/security/gitlab!1479

Add omniauth_user check when verifying user cap

See merge request gitlab-org/security/gitlab!1502

Add total http read timeout

See merge request gitlab-org/security/gitlab!1427

Some users can push to Protected Branch with Deploy keys

See merge request gitlab-org/security/gitlab!1478

Fix merge request diff display issue with unsupported encoding

See merge request gitlab-org/security/gitlab!1424

Igor Drozdov authored 3 years ago and Thong Kuah committed 3 years ago

It contains multiple security fixes.

One of them prevents string polymorphic route arguments and
causes some additional changes to be made along with just bumping
gem version

Changelog: security

Created a fork because rdoc 6.3.1 is missing a file.

Changelog: security

Changelog: security